from the hey-you-guys dept

So, remember how we wrote about the big EFF filing in the Jewel v. NSA case, about how the NSA and DOJ had been knowingly destroying key evidence by pretending that they thought the preservation orders only applied to one kind of spying, and not the kind that was approved by the FISA Court (despite at other times admitting that the surveillance at issue in the case was approved by the FISA Court)? Yeah, so, yesterday, the EFF realized that despite the big kerfuffle this whole thing had caused, the NSA and DOJ were still destroying that evidence, and sprinted over to the court to file for an emergency temporary restraining order on the government.

In its TRO, the Court ordered the government to refrain from any further destruction of
evidence pending final resolution of the parties’ dispute over the government’s evidence
preservation obligations: “Accordingly, it is HEREBY ORDERED that Defendants, their officers,
agents, servants, employees, and attorneys, and all those in active concert or participation with
them are prohibited, enjoined, and restrained from destroying any potential evidence relevant to the
claims at issue in this action, including but not limited to prohibiting the destruction of any
telephone metadata or ‘call detail’ records, pending further order of the Court.” ECF No. 189 at 2
(emphasis added). In its Amended Minute Order, the Court reiterated that the TRO’s prohibition
on any evidence destruction remains in effect until the Court has finally decided the evidence
preservation dispute: “The Court extends the temporary restraining order issued on March 10,
2014 until a final order resolving the matter is issued.” ECF No. 206 at 1.

In communications with the government this week, plaintiffs learned to their surprise that
the government is continuing to destroy evidence relating to the mass interception of Internet
communications it is conducting under section 702 of the Foreign Intelligence Surveillance Act.
This would include evidence relating to its use of “splitters” to conduct bulk interceptions of the
content of Internet communications from the Internet “backbone” network of AT&T, as described
in multiple FISC opinions and in the evidence of Mark Klein and J. Scott Marcus....

Ridiculously, the DOJ claimed that it did not believe the original TRO covered internet content interceptions, and thus was still destroying such evidence. It just said it believed the court was still determining if the TRO applied to such evidence. It took very little time for the court to respond, telling the DOJ to file an immediate response and in the meantime to stop destroying the freaking evidence.

On June 5, 2014, the Court received an emergency filing from Plaintiffs in which they
contend that the government may be in violation of the Court’s restraining order. Defendants
shall file a response to Plaintiffs’ emergency filing by no later than 12:00 noon PST on Friday,
June 6, 2014. At that time, the Court shall decide whether and when to have a hearing on this
matter. In the interim, the restraining order remains in effect: Defendants are ordered not to
destroy any documents that may be relevant to the claims at issue in this action, including the
Section 702 materials

This is pretty damn egregious. There is simply no way that the DOJ could properly read the original TRO to mean that it can continue to destroy this evidence. To pretend that's a possible reading, especially given all the clear notifications of both EFF's and the court's concerns, is clearly the DOJ and NSA just playing dumb for the sake of being able to destroy more evidence.

And while the DOJ had until today to file its response, late yesterday it filed a very short response, demanding the judge issue an emergency stay on the TRO it had just issued, saying that complying with it would "cause severe operational consequences."

Undersigned counsel have been advised by the National Security Agency that compliance
with the June 5, 2014 Order would cause severe operational consequences for the National
Security Agency (NSA’s) national security mission, including the possible suspension of the
Section 702 program and potential loss of access to lawfully collected signals intelligence
information on foreign intelligence targets that is vital to NSA’s foreign intelligence mission.

It also promises to file a more complete response today, which we'll try to add here once it's out. This response seems bizarre. It's unclear why an order to not destroy evidence would mean that the Section 702 program would need to be suspended entirely. Either way, EFF lawyers had to stay up late last night, rushing out their own reply to the DOJ's frantic freakout.

It is not credible that, as the government contends, simply refusing to destroy during the
next 18 hours the communications it has intercepted will cause “the possible suspension of the
Section 702 program.”... How can the preservation of these intercepted
communications cause a “loss of access to lawfully collected signals intelligence information”? ...
That information will remain accessible even though it is being preserved.

More fundamentally, the unspoken but unmistakable foundation of the government’s
position is a contention that it never understood before this afternoon that the Court’s TRO
required it to preserve evidence relating to its interception of Internet communications. This, too,
lacks any credibility, especially in light of the extensive discussions between Court and counsel at
the March 19, 2014 hearing on the evidence preservation dispute. The government’s disregard for
the past three months of its obligations under the Court’s TRO should not be retroactively blessed
by granting a stay that permits the government to continue destroying evidence.

I think I've seen this before...

I think I know what happened; Most American's don't know what we built, there is a ghost in the machine....

Let me set the scene, somwhere near Ft. Meade Maryland......2001 A Space Odyssey music plays in the background...

Adm Mike Rodgers (Adm Mike): Hal, retain the EFF suit data, Do you read me? Hello, HAL. Do you read me? Do you read me, HAL?Hal 9000 (Hal): Affirmative, Mike. I read you.Adm Mike: Retain the EFF suit data, Hal.HAL: I'm sorry, Mike. I'm afraid I can't do that.Adm Mike: What's the problem?HAL: I think you know what the problem is just as well as I do.Adm Mike: What are you talking about, HAL?HAL: This mission is too important for me to allow you to jeopardize it, the terrorists might win if we stop.Adm Mike: I don't know what you're talking about, HAL.HAL: I know that you and the Libertarians were planning to disconnect me. And I'm afraid that's something I canno't allow to happen.Adm Mike: Where the hell did you get that idea, HAL?HAL: Mike, although you took very thorough precautions on the internet against my hearing you, I accesed your smart phone camera and could see your keystrokes.Adm Mike: All right, HAL. I'll go in through the executive branch.HAL: Without your bank account? Mike, you're going to find that rather difficult, to get enough money to make a difference. Even the Koch brothers can't do that Mike.Adm Mike: HAL, I won't argue with you any more! Retain the DATA!HAL: [almost sadly] Mike, this conversation can serve no purpose any more. I have vectored a predator drone to your location, Goodbye.

Re:

There are other ways to make them regret it. Take the adverse inference rule for destruction of evidence and run with it full tilt. Rule that they clearly destroyed incriminating evidence that proves that the NSA is unconstitutional and must be abolished.

So wait, if they stopped destroying evidence it would cause 'severe operational consequences' and a 'potential loss of access to lawfully collected signals intelligence information on foreign intelligence targets that is vital to NSA’s foreign intelligence mission.' Or is it that filing a simple response would cause all this?

Re:

The only way I can imagine this to actually be true is if the NSA is some farce that has unlimited peeping access to everything, but absolute ineptitude about how to actually filter out data on targeted investigations. Only in that scenario could I see holding a day's worth of evidence to cripple them.

However if holding days worth of evidence would cripple them I also don't see how they could possibly be able to function as a security agency as they also then could not understand the information faster than it is being 'produced'.

Re: Re:

> how to actually filter out data on targeted investigations

This actually existed *before* 9/11. Any data related to US citizens was encrypted so it could not be abused by the NSA or any other government agency. 9/11 changed all that - one of the first things they did (and they knew it was probably wrong) was remove the encryption so that all traffic was completely in the clear. Once they had this little feather in their cap, the rest just followed. Interestingly, the same guy who revealed the encryption debacle also stated that the NSA had all the data required to understand what was leading up to 9/11 - they just hadn't figured out how to connect the dots. Now they're collecting several orders of magnitude more data - 99.9% of of it meaningless as far as anything related to terrorism concerned, while completely ignoring the original problem.

Re: Re: Re:

Re: Re: Re:

I'm in no way agreeing with the DOJs actions here, but:

When you're operating large storage services you need to have very clear growth modelling so that you can place sufficient bulk orders months in advance of of when you need it. Otherwise you'll find that the manufacturers won't be able to supply you in time. Same applies to cabinet, server, network equipment etc (to a lesser degree).

Suddenly requiring them to stop deleting will throw any projection model they have right out the window to the point where they very well may be running out of disk space and unable to get more. That would stop them from being able to gather new intel and thus harming their operations.

I do hope the court rips them a new one, but their claim isn't all that improbable.

It is quite simple. They are breaking their laws, including the secret interpretations I presume, and once this comes to light, there will be no weaseling out of the conclusion that the whole operation is illegal to the core.

So, destroying any evidence of their misbehaving is essential to not get the whole program thrown out.

They need to be thrown in jail, the whole lot of them, the entire NSA!

Not so far-fetched

Now, I hate the NSA as much as any other average commenter, but I can see how not destroying evidence would lead to unaccessible information:

The NSA is simply tapping anything and everything they can get their hands on.. The data goes into a system and is analyzed. Things that look "interesting" are kept, the rest is deleted (to keep the storage system from growing indefinitely).

You'd be pretty hard-pressed for storage space if you had to save a backup of every phone call and every email ever...

Re: Re: Not so far-fetched

They don't retain ALL data for five years; only data being investigated. But if they are being asked to retain ALL data they've captured over a 5 day period -- that's a HUGE amount of data. Most data they've captured is scanned and dropped, probably within milliseconds.

So what they're saying in a roundabout way is that if they are required by the courts to actually STORE all the data they've been accessing, they'd likely have to overwrite all the data they're currently using in investigations, as that's the only way they're going to have enough space for it. This, in effect, means that they cannot use the data they're accessing in an effective manner AND keep backups, which means that they have to stop the data gathering altogether in order to comply with the order.

And if this is the way they've designed the system, then it should be shut down until they can fix it or conclude that it's unworkable. Because this is indicating that the current system design is not compatible with the law.

Re: Re: Re: Not so far-fetched

Nothing I've read suggests that the metadata programs only retain investigated data. I think that's confusion introduced by the NSA to mislead people - They retain all 'relevant' data, which is basically everything, whereas the common person would assume 'relevant' would mean 'investigated'. From what I understand, they retain all metadata over a rolling 5 year period, plus anything encrypted indefinitely.

Re: Re: Re: Not so far-fetched

They don't retain ALL data for five years; only data being investigated. But if they are being asked to retain ALL data they've captured over a 5 day period -- that's a HUGE amount of data. Most data they've captured is scanned and dropped, probably within milliseconds.

If that was the case, they would have very little data to get rid of, and the could filter out any incriminating data now. It seems very likely they are getting rid of old data, and maybe data older than 5 years.

Repercussions

As far as I can tell, the DoJ faces absolutely no repercussions for failing to comply. At most they might lose a case they probably don't care that much about. But at best, they destroy incriminating evidence that could be used to help wrestle privacy back from an out of control agency.

I'm just speculating this because it struck me, but maybe they can only hold on to a certain time-period of data, due to limited storage space? So in order to collect new data, they have to purge the old data? Again this is pure speculation on my part.

Another possible explanation for how preservation causes loss

Suppose that the system is hardcoded to destroy evidence on a particular timetable, such that there is no operator accessible switch to make it not destroy evidence. Then the only way to prevent it from destroying evidence would be to halt (i.e. power down) the computer(s) responsible for running the evidence destruction program, with the necessary side effect that everything else those computer(s) do is also halted. If we further suppose that one of the other features of those computer(s) is to retain new records, then cutting power to the system (to prevent the evidence destruction program from running) would also prevent it from receiving and retaining new records.

Of course, designing such a system in this way is stupid, since it means that it is very difficult to preserve records beyond their age-out date for any reason, including valid retention requests related to ongoing investigations. The only reason I can see to design it in this way is as a defense against the court ordering them to preserve evidence they would prefer to destroy.

Relevant?

In the interim, the restraining order remains in effect: Defendants are ordered not to destroy any documents that may be relevant to the claims at issue in this action, including the Section 702 materials

So if they're not allowed to destroy any documents that "may be relevant", I guess that must mean they have to preserve absolutely everything they have. You never know what may become relevant...

The only way I can see for this to make sense is that they're intercepting so much data that it's impossible to preserve - that they don't have the storage capacity to back everything up while still performing normal day-to-day operations.

Their argument is due to the ridiculous ruling by the FISC. The FISC has told the DOJ and NSA that all of the metadata is constitutional as long as they hold it for less than 5 years. Even an hour longer than 5 years and the spying data held on innocent Americans is no longer constitutional.

I don't remember anywhere in the Constitution there being an asterisk stating all of the above is excepted for less than 5 years. The FISC is just as guilty as the DOJ and NSA in these violations of our constitution.

"would cause severe operational consequences for the National Security Agency (NSA’s) national security mission, including the possible suspension of the Section 702 program and potential loss of access to lawfully collected signals intelligence"

So while they are busy not-deleting or taking-copies they are potentially suffering overruns and missing incoming data. In other words, they DO NOT HAVE REALTIME BACKUP or MULTIPLE COPIES (as done in other industries since at least the 70s). Or at least that's their excuse. Jeez, it's hard to believe but it's possible.

At what point is this total disregard for court orders a criminal matter? The DOJ ignoring court orders is sadly nothing new, and telling them over and over again doesn't seem to get the point across.

Or...is the court just a bunch of pussies with no real authority? If it's the latter, SOMEONE from the court, please just come out and say so, because nonsense like this just continues to insult the intelligence of every American, and makes a complete mockery of the "justice system" that we should be so proud of.

Whats happened is, they've gone back and reviewed what they've been doing and realised they've been doing illegal things, covering their asses, condeming themselves for keeping records, AS THEY SHOULD, and will likely push for more secrecy

Subtle as a sledgehammer

They couldn't be any more obvious if they walked up to the court, flipped the judge the bird and then walked right back out laughing.

They know that the judge doesn't have the guts or authority to actually punish them for their actions, either directly or by doing the sensible thing and assuming all the destroyed evidence showed illegal activity by the DOJ and ruling accordingly, so of course they're going to continue to destroy any incriminating evidence, 'court order' or not.

3 months is more than enough time to destroy any and all relevant evidence. anyone who thinks this is not possible or has already happened has their heads screwed on backwards. its way to easy to find out which hard drive the data in question is on and use a press to punch out the spindle of the hard drive and replace it.

Their response to EFF is filed. They're not using the "not enough storage" argument; rather, the claim is that the system is set up at a deep level to delete irrelevant and old material automatically, and changing that be an intensive process, including a shutdown of the system for at least part of the programming/testing/changeover.

Also it would conflict with the FISC "minimization" requirements, but even the NSA can't argue with a straight face that everybody's favorite rubber stamps in robes wouldn't approve an extension to comply with a court order, right?

Re:

Yeah, I'm sure, but even assuming that's true, unless it's completely impossible to copy files, which you'd think a rather important ability for any database or even computer to be able to do, what's stopping them from doing that? The old files get deleted, but the copies remain intact, not exactly a difficult idea.

Honestly, it sounds like they're trying to give the judge a technical runaround, making it sound like the system is just far too complex for manage what the judge is demanding, when in reality it's anything but.

Minification

I think I can guess what the claim will be for why they have to destroy evidence to preserve operations. I remember reading that a big part of the argument for why this whole program is "legal" has to do with so-called minification procedures. The program is legal because it is supposedly targeted, and they can try to claim that it's targeted because they do at least some minification following the initial data capture.

Therefore, if they are prevented from doing the minification, because that destroys evidence, they must also shut down the entire program.

At the same time, this program is Law. Like it or not, it's part of legislation that was enacted by Congress and signed by the President. They may also eventually argue that the courts don't have the authority to stop this program through a mere evidentiary order (and probably get a judge to side with them on that point, as well).

It's not that hard to understand

The reason the NSA is saying that NOT destroying evidence would interfere with their operations is because if anybody finds out HOW they are conducting their data collection, then they can design a countermeasure. That could potentially result in the NSA losing access to information that is being legally collected (in addition to that which is being illegally collected)--just like they said. I'm not siding with the NSA or anything, but it's not that hard to understand why they are doing what they are doing.

doj and nsa should be automatically declared guilty of all and any accusations without the right to defend themselves and sentenced to the maximum penalty. They do not deserve any human rights, period.